@ziffer-io/client 0.1.0 → 0.2.0

package/README.md

@@ -1,69 +1,130 @@
-# `@ziffer-io/client`
+# @ziffer-io/client
 
-The TypeScript SDK for the ZIFFER decision API: submit a proposal, wait for the decision, and
-verify the receipt before you act on it.
+The ZIFFER client for TypeScript. Propose an action, wait for the decision, and verify the signed
+receipt in your own process before you act.
+
+## Install
 
 ```bash
 npm install @ziffer-io/client
 ```
 
-That one line brings the wire types (`@ziffer-io/types`) and the verifier (`@ziffer-io/verify`)
-with it. `verifyReceipt` is **re-exported unchanged** from the verifier's own package, so there is
-one verifier in your dependency tree rather than two that can disagree — the tests assert it is
-the same function object, so the re-export cannot decay into a copy quietly.
+Node 22 or later. The wire types and the receipt verifier are installed with it.
 
-## The whole integration
+## Quickstart
 
 ```ts
-import { ZifferClient, verifyReceipt, Refusal, type TrustAnchor } from '@ziffer-io/client';
+import { readFileSync } from 'node:fs';
+import { ZifferClient, verifyReceipt, type TrustAnchor } from '@ziffer-io/client';
 
-const client = new ZifferClient(process.env.ZIFFER_API_URL, process.env.ZIFFER_API_KEY);
-const anchor: TrustAnchor = await loadAnchor(process.env.ZIFFER_TRUST_ANCHOR);
+const keys = JSON.parse(readFileSync(process.env.ZIFFER_TRUST_ANCHOR, 'utf8'));
+const anchor: TrustAnchor = {
+  classical: Buffer.from(keys.ed25519_pk_hex, 'hex'),
+  pq: Buffer.from(keys.mldsa65_pk_hex, 'hex'),
+  minSuite: process.env.ZIFFER_SUITE_FLOOR,
+};
 
+const client = new ZifferClient(process.env.ZIFFER_API_URL, process.env.ZIFFER_API_KEY);
 const submitted = await client.propose(proposal);
 const decision = await client.wait(submitted.decision_id, { timeoutMs: 30_000 });
-if (decision.outcome !== 'ALLOW') throw new Error(`ziffer refused: ${decision.clause}`);
+if (decision.outcome !== 'ALLOW') throw new Error(`ziffer refused: ${decision.refusal_category}`);
 
 verifyReceipt(decision.receipt, new TextEncoder().encode(JSON.stringify(proposal)), anchor);
-await bank.transfer(amount, toAccount);          // your line, unchanged
+await bank.transfer(amount, toAccount);   // your line, unchanged
 ```
 
-`verifyReceipt` throws on any defect. Catch `Refusal` and read `.clause` — narrow with
-`instanceof`, never a cast: a `catch` binds `unknown` and also sees the errors you did not plan
-for, so an `as Refusal` would read a `clause` off a `TypeError` and report a protocol refusal that
-never happened.
-
-`docs/onboarding/sdk.md` section 8 is the same integration at length, with what each refusal means.
-
-## What it does not do
-
-- **It computes no security value, and that is deliberate.** The proposal goes out as you wrote it
-  and the receipt comes back as the gateway stored it. A compromised client writes the whole
-  message, so nothing a client derives about its own request is evidence (RES-8). Every check that
-  matters happens inside `verifyReceipt`, over bytes you supply.
-- **`ALLOW` is not permission to act; the verified receipt is.** The outcome field is transmitted
-  data. Nothing is gated until `verifyReceipt` has returned without throwing, and a handler that
-  calls it without branching on it is not gated at all.
-- **It does not fetch your trust anchor.** `TrustAnchor` is an argument. Obtain the
-  `acp-bundle pubkey` document out of band; an anchor the API served you proves nothing about the
-  API.
-- **It does not choose your signature-suite floor.** There is no default, deliberately.
-- **It has no `approve` and no sandbox shortcut that mints a receipt.** Approval happens inside
-  the deployment, under keys your process never holds.
-- **A pass from `verifyReceipt` is the stateless half of §9.3 only.** `@ziffer-io/verify`'s README
-  lists the six steps that need a signed bundle, a ledger and a context store, and are absent
-  rather than approximated.
-
-## Development
-
-```sh
-pnpm --filter @ziffer-io/client test   # tsc -b && node --test
+You pass the proposal twice on purpose. The verifier hashes the bytes you hand it and compares
+them with the receipt's claim. The check is against your copy, not against ours. Key order and
+spacing do not matter.
+
+`verifyReceipt` checks the answer. Your own `if` is what stops the action.
+
+An action that needs human approval answers `ATTEST` and no receipt. Keep polling
+`client.wait` for the same decision id until `decision.receipt` is present, then verify it.
+
+Under TypeScript's strict settings `process.env` values are typed `string | undefined`. Read them
+through a small helper that throws when one is not set. The SDK guide has one.
+
+## Configuration
+
+| Variable | What it is | Where the value comes from |
+| --- | --- | --- |
+| `ZIFFER_API_KEY` | Your API key. It carries your tenant, so no request names a tenant. | We issue it. It expires after 90 days unless you ask for another lifetime. |
+| `ZIFFER_TRUST_ANCHOR` | Path to the public key file your receipts are signed under. | We give you the file. Take it from us, never from the API you are checking. |
+| `ZIFFER_SUITE_FLOOR` | The weakest signature suite you will accept. | You choose it. There is no default. |
+| `ZIFFER_API_URL` | The base URL of the ZIFFER deployment you call. | We give it to you with your key. |
+
+## When a request is refused
+
+Every refusal is a thrown `Refusal` whose `clause` names the rule that fired; the table of every
+clause, what it means and what to do is at https://ziffer.io/docs/refusals. Narrow with
+`instanceof Refusal`, record the clause, and do not retry it.
+
+## When a call does not get through
+
+The client resends a request only when resending can help. That is: when the call got no answer at
+all — the connection was refused, DNS failed, or the round trip took longer than 10 seconds — and
+when the answer was 429, 502, 503 or 504.
+
+Everything else reaches you as it is. A 400, 401, 403 or 404 means the request was refused on its
+merits, and the same bytes will be refused the same way. A 500 is not resent either, and that one
+is deliberate: ZIFFER reports its own degradations as 502 and 503, so a 500 is a fault it did not
+expect, and repeating it repeats the fault.
+
+Your bytes are sent again unchanged. A resent proposal lands on the hold the first attempt already
+opened, so a retry never asks a second person to approve the same action.
+
+There are at most five attempts. The wait between them doubles and is randomised, up to four
+seconds before the last one — randomised so that a fleet of your processes that all saw the same
+outage does not come back at the same instant. When an answer asks for a specific wait, in whole
+seconds, the client waits exactly that long and adds nothing of its own. Retrying is also a
+budget: ten retries the client decides for itself, one earned back per call that succeeds. A
+client whose calls are all failing stops resending instead of adding to the load.
+
+**The 10-second timeout is per attempt, not per call.** A call that retries can take longer than
+10 seconds and is not wrong for doing so. Waiting for a person to approve is not an attempt at
+all: that is `client.wait`, which polls, and each poll is its own attempt with its own timeout.
+
+### Putting a bound on the whole call
+
+```ts
+await client.propose(proposal, { deadlineMs: 5_000 });
+```
+
+With a deadline the client never starts a wait that would end after it. It throws
+`DeadlineExceeded` instead, and that error tells you what was actually failing — `lastError` and
+`status` — so you can tell "the gateway was down" from "my bound was too short". Without a
+deadline there is no such check, and a server that asks for a long wait gets it.
+
+### What the client has been doing
+
+```ts
+const { retries_directed, retries_computed, retry_bucket_level } = client.retryCounters;
 ```
 
-## Licence
+How many resends the server asked for, how many the client decided on itself, and how much of the
+retry budget is left (10 when full). The two counts run for the life of the client; read them
+before and after a call for that call's own numbers. They are worth a gauge in your own metrics:
+a `retries_computed` that climbs while `retry_bucket_level` sits at zero is the shape of an
+outage you are riding out rather than one you are told about.
+
+## Documentation
+
+- Quickstart: https://ziffer.io/docs/quickstart
+- Integrating the SDK: https://ziffer.io/docs/developers/sdk
+- Sandbox tenants: https://ziffer.io/docs/developers/sandbox
+- Every refusal: https://ziffer.io/docs/refusals
+- Policy by example: https://ziffer.io/docs/policy/by-example
+- Glossary: https://ziffer.io/docs/glossary
+
+## Support
+
+Write to hello@ziffer.io. Your API key, your trust anchor file and your suite floor come from us.
+So does an answer about a refusal you cannot explain.
+
+## License
 
-Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of code75
-SASU. This package is **not open source**: it is licensed for use with the ZIFFER service under
-your agreement with code75, on the terms in `LICENSE` beside this file. The third-party
-open-source components it redistributes are listed in `THIRD-PARTY-NOTICES` and are governed by
-their own licences.
+Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of
+code75 SASU. This package is not open source. Its use is governed by your agreement with code75
+and by `LICENSE` beside this file. The open-source components it redistributes are listed in
+`THIRD-PARTY-NOTICES`, under their own licences.

package/dist/client.d.ts

@@ -43,8 +43,31 @@
  * - A poll that outlives its deadline throws {@link WaitTimeout}. A timeout
  *   is "no answer yet", never "the answer was no" (ingress-low's rule for
  *   its own dependency, one layer out).
+ * - A call that was still retrying when the caller's deadline arrived throws
+ *   {@link DeadlineExceeded}, carrying the last failure's name and status.
+ *   Inside {@link ZifferClient.wait} it is caught and re-thrown as
+ *   {@link WaitTimeout} with that `DeadlineExceeded` as its `cause`: `wait`
+ *   has ONE name for "no answer yet" and a caller already catches it.
+ *
+ * # Timeouts and retries
+ *
+ * Every round trip carries an abort signal set to {@link REQUEST_TIMEOUT_MS}.
+ * **That timeout covers ONE ROUND TRIP** — the send and the reading of the
+ * answer's body — and is not a budget for the call: a call that retries may
+ * take several times as long and is not wrong for doing so. Waiting for a
+ * human to approve is not a round trip at all; that is {@link
+ * ZifferClient.wait}, which polls, and each poll is its own round trip under
+ * its own timeout.
+ *
+ * There is ONE request path and the retry loop is inside it, so `propose`,
+ * `decision` and every poll of `wait` retry under exactly the same rules
+ * (`retry.ts` holds them, `retry.test.ts` replays the corpus both SDKs share).
+ * The bytes are serialised once, above the loop, and the same bytes are
+ * resent: the gateway keys a pending hold on the hash of what it received, so
+ * identical bytes land on the same hold instead of opening a second one.
  */
 import type { wire } from '@ziffer-io/types';
+import { type RetryCounters } from './retry.js';
 /**
  * The header every SUCCESSFUL answer carries (ACP-256 §5): the instant the key
  * that authenticated the call ends, RFC 3339 in UTC. Lowercase because that is
@@ -92,11 +115,50 @@ export interface WireProposalPayload {
 }
 /** The two §1 states. `decided` means the relay recorded a verdict; it does
  * NOT mean a receipt exists — `receipt` is present iff one does. */
+/**
+ * ACP-392. One short message about something our documentation does not
+ * answer, and the ONLY thing this client sends that is not a Proposal.
+ *
+ * The three members are the route's CLOSED set: a fourth is refused by the
+ * gateway rather than dropped, so this type cannot quietly grow a field that
+ * carries a developer's environment off their machine. `context` is optional
+ * and absent means absent.
+ */
+export interface Feedback {
+    /** Which tool could not answer — free text, because the tools naming
+     * themselves live on the other side of this wire. */
+    readonly tool: string;
+    /** What was asked. */
+    readonly question: string;
+    /** Anything else worth knowing. Never a credential: it is stored as written
+     * and read by an operator. */
+    readonly context?: string;
+}
+/** What `POST /v1/feedback` answers. `tenant` is the one thing the caller did
+ * not send — the key carried it. */
+export interface FeedbackStored {
+    readonly stored: true;
+    readonly tenant: string;
+}
 export type DecisionStatus = 'pending' | 'decided';
 /**
- * What both §1 routes answer. Refusals expose exactly `{outcome, clause}` —
- * the fields ingress-low's `relayed_response` exposes — and an absent
- * `clause` is ABSENT, never `null`: one object, one encoding.
+ * RF-4's refusal category (ACP-402): the one thing a caller's code needs to
+ * decide whether to try again, served INSTEAD of the clause on every
+ * tenant-facing decision route. A closed set of four, carried verbatim (RF-2):
+ * never mapped from anything, never invented, and a value outside the set is
+ * refused as a malformed answer rather than repaired into one of these.
+ *
+ * - `PolicyRefused` — a rule refused the action: never retry.
+ * - `PolicyBasisMoved` — the policy basis moved: retry once after activation.
+ * - `RateBounded` — retry later.
+ * - `ProposalMalformed` — fix the submission.
+ */
+export type RefusalCategory = 'PolicyRefused' | 'PolicyBasisMoved' | 'RateBounded' | 'ProposalMalformed';
+/**
+ * What both §1 routes answer. A refusal exposes `{outcome, refusal_category}`
+ * — never the clause, since ACP-402 (RF-4: the caller may be the agent being
+ * contained; the clause is in the console) — and an absent member is ABSENT,
+ * never `null`: one object, one encoding.
  */
 export interface Decision {
     /** The locator (T). Compare nothing against it; fetch with it. */
@@ -105,7 +167,11 @@ export interface Decision {
     /** The engine's outcome type — a fourth spelling of ALLOW / ATTEST / DENY
      * would be a fourth definition of the object every component agrees on. */
     readonly outcome?: wire.DecisionOutcome;
-    readonly clause?: string;
+    /** RF-4's category, for a DENY or a refused release. Absent otherwise. */
+    readonly refusal_category?: RefusalCategory;
+    /** DR-15: the action is HELD until this instant (RFC 3339 UTC) and no
+     * receipt is readable yet. Absent once it releases or is refused. */
+    readonly held_until?: string;
     /**
      * The signed receipt, verbatim from the one route that serves receipts
      * (GET). Deliberately `unknown`: its ONLY consumer is `verifyReceipt`,
@@ -114,6 +180,87 @@ export interface Decision {
      */
     readonly receipt?: unknown;
 }
+/** What a list item's `receipt` says. TWO WORDS, never the document: the
+ * receipt is served by exactly one route (`GET /v1/decisions/{id}`), and a
+ * boolean would read as "the receipt says no" — which is the sentence a DENY
+ * makes true and this member does not mean. */
+export type ReceiptPresence = 'attached' | 'absent';
+/**
+ * One row of {@link ZifferClient.list} (ACP-356).
+ *
+ * IT CARRIES NO CLAUSE AND NO RECEIPT DOCUMENT, and neither is an oversight.
+ * The list answers WHAT was decided and never WHY: the caller may be a
+ * compromised agent, and a sweepable list of clauses is an oracle over the
+ * customer's signed rules. The reason a request was refused is in the audit
+ * trail and, for a signed-in human, in the console — not at the API.
+ */
+export interface DecisionListItem {
+    readonly decision_id: string;
+    readonly status: DecisionStatus;
+    readonly receipt: ReceiptPresence;
+    /** When the gateway recorded the submission. Strict RFC 3339 UTC, to the
+     * second — the same grammar `since` takes. */
+    readonly created_at: string;
+    /** The Policy Engine is still holding this Proposal for a quorum. NOT the
+     * same as `outcome === 'ATTEST'`, which only says one was asked for. */
+    readonly waiting: boolean;
+    /** Absent while pending. */
+    readonly outcome?: wire.DecisionOutcome;
+    /** When the hold ends (AT-5). Present only while `waiting`. */
+    readonly expires_at?: string;
+    /** RF-4's category — the category, never the clause. */
+    readonly refusal_category?: RefusalCategory;
+    /** DR-15: held until this instant, no receipt yet. */
+    readonly held_until?: string;
+}
+/**
+ * One page of {@link ZifferClient.list}, and where the next one starts.
+ *
+ * `next_cursor` is `null` at the end — never `undefined`, because both values
+ * are ANSWERS and a caller must tell "this is the end" from "the server did
+ * not say". Hand it back UNCHANGED: it is opaque, and a cursor built by a
+ * caller is a second implementation of the gateway's ordering.
+ */
+export interface DecisionPage {
+    readonly items: readonly DecisionListItem[];
+    readonly next_cursor: string | null;
+}
+/** Per-call options for {@link ZifferClient.list}. */
+export interface ListOptions extends RequestOptions {
+    /** Strict RFC 3339 UTC, exactly `2026-09-21T18:00:00Z`. Default: 24 hours
+     * ago. May not reach further back than 730 days. */
+    readonly since?: string;
+    /** 1..200. Default 50. */
+    readonly limit?: number;
+    /** `next_cursor` from a previous page, unchanged. */
+    readonly cursor?: string;
+}
+/**
+ * What `GET /v1/whoami` answers (ACP-391): the customer this key is bound to,
+ * and when the key stops being accepted.
+ *
+ * TWO MEMBERS AND NO THIRD. A wider "tenant info" was considered and dropped:
+ * the live policy epoch, the bundle's expiry, the attester names and the three
+ * windows are the POLICY AUTHOR's business, nothing in this client needs them
+ * to call {@link ZifferClient.propose}, and a refusal already names its own
+ * clause. What is genuinely unanswerable from this side of the wire is which
+ * customer the key in an environment variable belongs to.
+ *
+ * `key_expires_at` is the same value {@link API_KEY_EXPIRES_HEADER} carries on
+ * every 2xx — one date written twice by the gateway from one source, so a
+ * caller that ASKED does not have to reach for a header to be told.
+ */
+export interface Identity {
+    /** The tenant the API key resolves to, as the key store holds it. Never a
+     * value this client chose: there is no parameter for it and a `tenant_id`
+     * in a proposal that disagrees is refused (`TenantMismatch`), not rewritten. */
+    readonly tenant_id: string;
+    /** Strict RFC 3339 UTC, rendered by the store. A string and not a parsed
+     * instant on purpose — the comparison that decides liveness is the store's,
+     * and a second place that parsed this would be a second opinion about when a
+     * key ends. */
+    readonly key_expires_at: string;
+}
 /** §1 names, exported so callers and tests never retype the strings. The set
  * is OPEN — the gateway may name more; {@link ApiRefusal} carries any name
  * verbatim and this list closes nothing. */
@@ -122,6 +269,17 @@ export declare const ERROR_TENANT_MISMATCH = "TenantMismatch";
 export declare const ERROR_PROPOSAL_MALFORMED = "ProposalMalformed";
 export declare const ERROR_DECISION_UNKNOWN = "DecisionUnknown";
 export declare const ERROR_ADMISSION_UNAVAILABLE = "AdmissionUnavailable";
+/** ACP-356. ONE name for every way the list's query string is not a legal
+ * one — which parameter, and why, is deliberately not said. */
+export declare const ERROR_LIST_QUERY_MALFORMED = "ListQueryMalformed";
+/** ACP-392. `POST /v1/feedback`'s four, in the gateway's own spelling
+ * (`services/gateway/src/gateway.rs::error_name`). They are exported for the
+ * same reason the five above are: a caller branching on a refusal should
+ * import the string rather than type it. */
+export declare const ERROR_FEEDBACK_MALFORMED = "FeedbackMalformed";
+export declare const ERROR_FEEDBACK_TOO_LARGE = "FeedbackTooLarge";
+export declare const ERROR_FEEDBACK_RATE_LIMITED = "FeedbackRateLimited";
+export declare const ERROR_FEEDBACK_UNAVAILABLE = "FeedbackUnavailable";
 /**
  * The gateway answered, and the answer was a named refusal. `error` is the
  * gateway's name, verbatim — the machine-readable half, as `Refusal.clause`
@@ -145,10 +303,18 @@ export declare class ResponseMalformed extends Error {
     constructor(message: string);
 }
 /** The deadline passed with the decision still `pending`. Not a refusal and
- * not an answer — the decision may still decide; the id remains fetchable. */
+ * not an answer — the decision may still decide; the id remains fetchable.
+ *
+ * `options.cause` is how the reason survives the rename. A poll that ran out
+ * of retry budget produced a {@link DeadlineExceeded} naming the last failure
+ * and its status; `wait` reports the event under the name its caller catches
+ * and hands the original through as `cause`, so nothing the caller could have
+ * learned from the poll is thrown away to keep one name at the surface. A
+ * rename that dropped the reason would make "no answer yet" indistinguishable
+ * from "the gateway was shedding for thirty seconds". */
 export declare class WaitTimeout extends Error {
     readonly decisionId: string;
-    constructor(decisionId: string, timeoutMs: number);
+    constructor(decisionId: string, timeoutMs: number, options?: ErrorOptions);
 }
 /** Options for {@link ZifferClient.wait}. */
 export interface WaitOptions {
@@ -157,6 +323,55 @@ export interface WaitOptions {
     /** Delay between polls. Default 500. */
     readonly intervalMs?: number;
 }
+/** What this client needs of `fetch`, and no more. Narrow on purpose: it is
+ * the seam the retry corpus is replayed through, and a seam typed as the whole
+ * of `fetch` would invite a test to script something this client never sends. */
+export interface FetchInit {
+    readonly method: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body?: string;
+    readonly signal: AbortSignal;
+}
+/** The injectable `fetch`. The default is the global one. */
+export type FetchLike = (url: string, init: FetchInit) => Promise<Response>;
+/** Per-call options for {@link ZifferClient.propose} and
+ * {@link ZifferClient.decision}. */
+export interface RequestOptions {
+    /**
+     * R5. How long from NOW this call may keep retrying, in milliseconds.
+     *
+     * Before every sleep, directed or computed, the client asks whether the
+     * sleep would end after this instant; if it would, it does not sleep and
+     * throws {@link DeadlineExceeded} carrying the last failure. Absent means
+     * no such check at all — the attempt cap and the token bucket are then the
+     * only bounds, and a server that asks for an hour gets an hour.
+     */
+    readonly deadlineMs?: number;
+}
+/**
+ * Construction-time options. Every one of them has a real default; the clock,
+ * the sleep, the draw and `fetch` exist as options so the shared retry corpus
+ * can be replayed deterministically, and for no other reason — a client built
+ * with none of them is the client a customer runs.
+ */
+export interface ZifferClientOptions {
+    /** R8. The abort timeout on ONE round trip. Default
+     * {@link REQUEST_TIMEOUT_MS}. */
+    readonly timeoutMs?: number;
+    /** Default: the global `fetch`. */
+    readonly fetch?: FetchLike;
+    /** Default: `Date.now`. */
+    readonly now?: () => number;
+    /** Default: `setTimeout`. */
+    readonly sleep?: (ms: number) => Promise<void>;
+    /** R2's `u`, in [0,1). Default: `Math.random`. */
+    readonly random?: () => number;
+    /** R6's bucket at construction. Default: full
+     * ({@link RETRY_BUCKET_CAPACITY}). A test seam — a deployment that wanted a
+     * smaller retry budget would be asking for a different rule, not a
+     * different starting level. */
+    readonly retryBucketInitial?: number;
+}
 /**
  * The client. One instance per (gateway, key); the KEY determines the tenant
  * server-side (§1), so there is nothing tenant-shaped to configure here —
@@ -165,33 +380,121 @@ export interface WaitOptions {
 export declare class ZifferClient {
     private readonly baseUrl;
     private readonly apiKey;
-    constructor(baseUrl: string, apiKey: string);
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly sleep;
+    private readonly random;
+    /** R6/R9: per CLIENT INSTANCE, as the rules say. Two clients do not share a
+     * retry budget, and one client's `propose` and `wait` do. */
+    private readonly retry;
+    constructor(baseUrl: string, apiKey: string, options?: ZifferClientOptions);
+    /**
+     * R9. The two retry counters and the bucket gauge, as a plain object taken
+     * at this instant. Cumulative over the client's life — a caller that wants
+     * a delta over one call reads it before and after.
+     */
+    get retryCounters(): RetryCounters;
     /**
      * POST /v1/proposals. The proposal is serialised as given — the caller's
      * values, no edits — and the answer never carries a receipt (§1): fetch it
      * with {@link decision} once decided.
+     *
+     * `opts.deadlineMs` bounds the RETRYING, not the round trip (R5).
      */
-    propose(proposal: WireProposal): Promise<Decision>;
+    propose(proposal: WireProposal, opts?: RequestOptions): Promise<Decision>;
+    /**
+     * POST /v1/feedback — tell ZIFFER what our documentation did not answer
+     * (ACP-392).
+     *
+     * THE TEXT LEAVES THE MACHINE. It is stored under the tenant this API key
+     * carries and read by an operator; nothing is filtered on the way, so
+     * anything put in `question` or `context` is anything an operator will
+     * read. The gateway refuses a member this shape does not define, which is
+     * what stops the object growing a field that carries more than a sentence.
+     *
+     * # ONE round trip and NO retry, unlike every other call on this client
+     *
+     * `request` retries a 429 and honours its `Retry-After`, which is right for
+     * work: a proposal that was refused for backpressure still has to happen.
+     * This is not work. A rate-limited feedback message is a message that will
+     * not be stored, and riding out a 60-second bucket would block the coding
+     * agent that called it for a minute to deliver a sentence. So the failure
+     * is raised as it arrives — [`ApiRefusal`] with the gateway's own name —
+     * and the caller decides.
+     */
+    feedback(message: Feedback): Promise<FeedbackStored>;
     /**
      * GET /v1/decisions/{id}. `receipt` is present iff a signed receipt
      * exists; hand it to `verifyReceipt` with your OWN copy of the proposal
      * bytes — the id proves nothing (T), the recomputed hash is the binding.
      */
-    decision(id: string): Promise<Decision>;
+    decision(id: string, opts?: RequestOptions): Promise<Decision>;
+    /** {@link decision}, with the deadline already resolved to an instant —
+     * which is what {@link wait} has and a caller does not. */
+    private fetchDecision;
+    /**
+     * GET /v1/whoami — which customer this key is bound to, and when it ends.
+     *
+     * The one call that asks about the CREDENTIAL rather than about a decision.
+     * It sends no body and takes no argument: there is nothing to name, because
+     * the key is the question. A dead key — expired, revoked or never minted —
+     * is one `ApiRefusal` (`ApiKeyUnknown`, 401) and the three cannot be told
+     * apart, which is deliberate at the gateway and is not this client's to
+     * undo.
+     */
+    whoami(opts?: RequestOptions): Promise<Identity>;
+    /**
+     * GET /v1/decisions — what ZIFFER holds and decided for THIS key.
+     *
+     * Every request waiting for approval (with when its hold ends) and every
+     * decision in the window, newest first. The tenant is the API key's and
+     * cannot be named any other way: there is no parameter for it and the
+     * gateway refuses one by name.
+     *
+     * Every bad parameter is one refusal, `ListQueryMalformed` (400). The API
+     * does not say which one, for the same reason an item carries no clause.
+     */
+    list(opts?: ListOptions): Promise<DecisionPage>;
     /**
      * Poll {@link decision} until `decided` or the deadline. A `WaitTimeout`
      * is "no answer yet", never a verdict; every named refusal (404 included)
      * propagates immediately — retrying `DecisionUnknown` would be the client
      * deciding the server was wrong.
+     *
+     * A poll that runs out of budget surfaces as `WaitTimeout` too, and NOT as
+     * the `DeadlineExceeded` the request path raised. Both mean "the wait's own
+     * deadline arrived with the decision still pending"; which of the two a
+     * caller saw depended on whether the last poll happened to be mid-retry,
+     * which is a detail of the gateway's load and not of this API. The
+     * `DeadlineExceeded` rides along as `cause`, so the last failure's name and
+     * status are still there for whoever wants them.
      */
     wait(id: string, opts?: WaitOptions): Promise<Decision>;
+    /** R5: the caller's duration becomes an instant on this client's clock,
+     * once, at the start of the call. `undefined` in, `undefined` out — no
+     * deadline means no check, not a check against infinity. */
+    private deadlineAt;
     /**
-     * One request, one parse, one narrowing. 2xx returns the parsed body for
-     * the caller's guard; anything else must be §1's `{"error": name}` and
-     * throws {@link ApiRefusal} with the name verbatim. A non-JSON or unnamed
-     * error body throws {@link ResponseMalformed} — an intermediary's HTML 502
-     * is not the gateway's answer and is never dressed up as one.
+     * THE request path: one loop, R1..R6, for every call this client makes.
+     *
+     * `body` arrives already serialised and is resent unchanged (R7). The loop
+     * owns nothing about the rules themselves — `retry.ts` decides, this
+     * sleeps, sends again, or throws what the last attempt produced.
      */
     private request;
+    /**
+     * ONE round trip: one request, one parse, one narrowing. 2xx returns the
+     * parsed body for the caller's guard; anything else must be §1's
+     * `{"error": name}` and yields {@link ApiRefusal} with the name verbatim. A
+     * non-JSON or unnamed error body yields {@link ResponseMalformed} — an
+     * intermediary's HTML 502 is not the gateway's answer and is never dressed
+     * up as one, though it IS retried, because 502 is retryable whoever wrote it.
+     *
+     * Nothing is thrown from here: the failure is RETURNED, because whether it
+     * becomes the caller's error is the retry loop's question and not this
+     * method's.
+     */
+    private roundTrip;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAI7C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAS9C,gEAAgE;AAChE,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAuCD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;mCACmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;oEACoE;AACpE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;+EAC2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID;;4CAE4C;AAC5C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AACrD,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AACxD,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAM1C;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED;8EAC8E;AAC9E,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAKlD;AAyED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAc3C;;;;OAIG;IACG,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKxD;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAiB7C;;;;;OAKG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmB7D;;;;;;OAMG;YACW,OAAO;CAwCtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAIpB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAS9C,gEAAgE;AAChE,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAuCD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;mCACmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;oEACoE;AACpE;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB;yDACqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;kCAC8B;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;oCACoC;AACpC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,mBAAmB,CAAC;AAyCxB;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;+EAC2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAC5C;yEACqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;+CAG+C;AAC/C,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;kDAC8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;4EACwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAC5C,sDAAsD;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD;wDACoD;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB;;oFAEgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;mBAGe;IACf,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAID;;4CAE4C;AAC5C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AACrD,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AACxD,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE;+DAC+D;AAC/D,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAC/D;;;4CAG4C;AAC5C,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AACjE,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAM1C;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;yDASyD;AACzD,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAK1E;AAwLD,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;iFAEiF;AACjF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5E;oCACoC;AACpC,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;qCACiC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,6BAA6B;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B;;;mCAG+B;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAuCD;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC;iEAC6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB;IAwB1E;;;;OAIG;IACH,IAAI,aAAa,IAAI,aAAa,CAEjC;IAED;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAe/E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAyB1D;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOpE;+DAC2D;YAC7C,aAAa;IAsB3B;;;;;;;;;OASG;IACG,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUtD;;;;;;;;;;OAUG;IACG,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAqBrD;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmC7D;;gEAE4D;IAC5D,OAAO,CAAC,UAAU;IAUlB;;;;;;OAMG;YACW,OAAO;IAgCrB;;;;;;;;;;;OAWG;YACW,SAAS;CA2FxB"}